What is the CVSS score of CVE-2021-47909?

CVE-2021-47909 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2021-47909?

Within 24 hours: Identify all instances of Mult-E-Cart Ultimate 2.4 in your environment and restrict database access to essential users only. Within 7 days: Deploy WAF rules to filter malicious SQL patterns in the 'id' parameter across inventory, customer, vendor, and order modules; consider disabling vendor self-service features until remediation is available. Within 30 days: Contact the vendor for patch availability; evaluate migration to a patched version or alternative e-commerce platform; conduct database audit for signs of compromise.

CVE-2021-47909

HIGH

SQL Injection (CWE-89)

2026-02-01 disclosure@vulncheck.com

SQLi

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 01, 2026 - 13:15 nvd

HIGH 8.1

DescriptionCVE.org

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.

Affected ProductsAI

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with priv

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.